Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 22:12
Static task
static1
Behavioral task
behavioral1
Sample
bd5b9329dce9d28b3ef8aba91494d54e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bd5b9329dce9d28b3ef8aba91494d54e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bd5b9329dce9d28b3ef8aba91494d54e_JaffaCakes118.exe
-
Size
48KB
-
MD5
bd5b9329dce9d28b3ef8aba91494d54e
-
SHA1
9f3838987cf3636cb555d927829a77da660b9e18
-
SHA256
bd564910525c66d85064008b1b0bd83d0098de2fc3dc61d2ffa49e04195ed842
-
SHA512
75d28683402913fa65bd149aba35124a79fbc091450e05b8d03906c29862702a0363f1c42d410f80e5f5a866542ce63ce16a8631a4fe4bd60ef4e1661ee21a57
-
SSDEEP
768:dbZf4IlYHLIaHR2dXvq50wh5E9g7uUh7986dOXpRo7t845kFEntNOY:dlf4pXHiX+0whSgThZeXpX+ntkY
Malware Config
Signatures
-
Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk bd5b9329dce9d28b3ef8aba91494d54e_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsregt.exe -
Executes dropped EXE 64 IoCs
pid Process 2916 dwdsregt.exe 2796 dwdsregt.exe 3004 dwdsregt.exe 2660 dwdsregt.exe 2632 dwdsregt.exe 1920 dwdsregt.exe 2188 dwdsregt.exe 2388 dwdsregt.exe 1712 dwdsregt.exe 2952 dwdsregt.exe 1620 dwdsregt.exe 1320 dwdsregt.exe 332 dwdsregt.exe 3016 dwdsregt.exe 2192 dwdsregt.exe 1500 dwdsregt.exe 1852 dwdsregt.exe 1740 dwdsregt.exe 1572 dwdsregt.exe 1272 dwdsregt.exe 800 dwdsregt.exe 2524 dwdsregt.exe 2584 dwdsregt.exe 2408 dwdsregt.exe 3068 dwdsregt.exe 1032 dwdsregt.exe 2088 dwdsregt.exe 876 dwdsregt.exe 2436 dwdsregt.exe 1000 dwdsregt.exe 2236 dwdsregt.exe 2868 dwdsregt.exe 2764 dwdsregt.exe 2796 dwdsregt.exe 2816 dwdsregt.exe 1192 dwdsregt.exe 2652 dwdsregt.exe 2124 dwdsregt.exe 2620 dwdsregt.exe 2376 dwdsregt.exe 2320 dwdsregt.exe 2960 dwdsregt.exe 840 dwdsregt.exe 1760 dwdsregt.exe 1840 dwdsregt.exe 1372 dwdsregt.exe 2968 dwdsregt.exe 1092 dwdsregt.exe 1564 dwdsregt.exe 916 dwdsregt.exe 2092 dwdsregt.exe 2192 dwdsregt.exe 1500 dwdsregt.exe 1852 dwdsregt.exe 808 dwdsregt.exe 2056 dwdsregt.exe 940 dwdsregt.exe 776 dwdsregt.exe 2720 dwdsregt.exe 1632 dwdsregt.exe 2596 dwdsregt.exe 3068 dwdsregt.exe 1032 dwdsregt.exe 2292 dwdsregt.exe -
Loads dropped DLL 64 IoCs
pid Process 1916 bd5b9329dce9d28b3ef8aba91494d54e_JaffaCakes118.exe 1916 bd5b9329dce9d28b3ef8aba91494d54e_JaffaCakes118.exe 2916 dwdsregt.exe 2916 dwdsregt.exe 2796 dwdsregt.exe 2796 dwdsregt.exe 3004 dwdsregt.exe 3004 dwdsregt.exe 2660 dwdsregt.exe 2660 dwdsregt.exe 2632 dwdsregt.exe 2632 dwdsregt.exe 1920 dwdsregt.exe 1920 dwdsregt.exe 2188 dwdsregt.exe 2188 dwdsregt.exe 2388 dwdsregt.exe 2388 dwdsregt.exe 1712 dwdsregt.exe 1712 dwdsregt.exe 2952 dwdsregt.exe 2952 dwdsregt.exe 1620 dwdsregt.exe 1620 dwdsregt.exe 1320 dwdsregt.exe 1320 dwdsregt.exe 332 dwdsregt.exe 332 dwdsregt.exe 3016 dwdsregt.exe 3016 dwdsregt.exe 2192 dwdsregt.exe 2192 dwdsregt.exe 1500 dwdsregt.exe 1500 dwdsregt.exe 1852 dwdsregt.exe 1852 dwdsregt.exe 1740 dwdsregt.exe 1740 dwdsregt.exe 1572 dwdsregt.exe 1572 dwdsregt.exe 1272 dwdsregt.exe 1272 dwdsregt.exe 800 dwdsregt.exe 800 dwdsregt.exe 2524 dwdsregt.exe 2524 dwdsregt.exe 2584 dwdsregt.exe 2584 dwdsregt.exe 2408 dwdsregt.exe 2408 dwdsregt.exe 3068 dwdsregt.exe 3068 dwdsregt.exe 1032 dwdsregt.exe 1032 dwdsregt.exe 2088 dwdsregt.exe 2088 dwdsregt.exe 876 dwdsregt.exe 876 dwdsregt.exe 2436 dwdsregt.exe 2436 dwdsregt.exe 1000 dwdsregt.exe 1000 dwdsregt.exe 2236 dwdsregt.exe 2236 dwdsregt.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log bd5b9329dce9d28b3ef8aba91494d54e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\dwdsregt.exe bd5b9329dce9d28b3ef8aba91494d54e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe File opened for modification C:\Windows\SysWOW64\msnav32.ax dwdsregt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_23_08_24.log dwdsregt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsregt.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1916 bd5b9329dce9d28b3ef8aba91494d54e_JaffaCakes118.exe 2916 dwdsregt.exe 2796 dwdsregt.exe 3004 dwdsregt.exe 2660 dwdsregt.exe 2632 dwdsregt.exe 1920 dwdsregt.exe 2188 dwdsregt.exe 2388 dwdsregt.exe 1712 dwdsregt.exe 2952 dwdsregt.exe 1620 dwdsregt.exe 1320 dwdsregt.exe 332 dwdsregt.exe 3016 dwdsregt.exe 2192 dwdsregt.exe 1500 dwdsregt.exe 1852 dwdsregt.exe 1740 dwdsregt.exe 1572 dwdsregt.exe 1272 dwdsregt.exe 800 dwdsregt.exe 2524 dwdsregt.exe 2584 dwdsregt.exe 2408 dwdsregt.exe 3068 dwdsregt.exe 1032 dwdsregt.exe 2088 dwdsregt.exe 876 dwdsregt.exe 2436 dwdsregt.exe 1000 dwdsregt.exe 2236 dwdsregt.exe 2868 dwdsregt.exe 2764 dwdsregt.exe 2796 dwdsregt.exe 2816 dwdsregt.exe 1192 dwdsregt.exe 2652 dwdsregt.exe 2124 dwdsregt.exe 2620 dwdsregt.exe 2376 dwdsregt.exe 2320 dwdsregt.exe 2960 dwdsregt.exe 840 dwdsregt.exe 1760 dwdsregt.exe 1840 dwdsregt.exe 1372 dwdsregt.exe 2968 dwdsregt.exe 1092 dwdsregt.exe 1564 dwdsregt.exe 916 dwdsregt.exe 2092 dwdsregt.exe 2192 dwdsregt.exe 1500 dwdsregt.exe 1852 dwdsregt.exe 808 dwdsregt.exe 2056 dwdsregt.exe 940 dwdsregt.exe 776 dwdsregt.exe 2720 dwdsregt.exe 1632 dwdsregt.exe 2596 dwdsregt.exe 3068 dwdsregt.exe 1032 dwdsregt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2916 1916 bd5b9329dce9d28b3ef8aba91494d54e_JaffaCakes118.exe 30 PID 1916 wrote to memory of 2916 1916 bd5b9329dce9d28b3ef8aba91494d54e_JaffaCakes118.exe 30 PID 1916 wrote to memory of 2916 1916 bd5b9329dce9d28b3ef8aba91494d54e_JaffaCakes118.exe 30 PID 1916 wrote to memory of 2916 1916 bd5b9329dce9d28b3ef8aba91494d54e_JaffaCakes118.exe 30 PID 2916 wrote to memory of 2796 2916 dwdsregt.exe 31 PID 2916 wrote to memory of 2796 2916 dwdsregt.exe 31 PID 2916 wrote to memory of 2796 2916 dwdsregt.exe 31 PID 2916 wrote to memory of 2796 2916 dwdsregt.exe 31 PID 2796 wrote to memory of 3004 2796 dwdsregt.exe 32 PID 2796 wrote to memory of 3004 2796 dwdsregt.exe 32 PID 2796 wrote to memory of 3004 2796 dwdsregt.exe 32 PID 2796 wrote to memory of 3004 2796 dwdsregt.exe 32 PID 3004 wrote to memory of 2660 3004 dwdsregt.exe 33 PID 3004 wrote to memory of 2660 3004 dwdsregt.exe 33 PID 3004 wrote to memory of 2660 3004 dwdsregt.exe 33 PID 3004 wrote to memory of 2660 3004 dwdsregt.exe 33 PID 2660 wrote to memory of 2632 2660 dwdsregt.exe 34 PID 2660 wrote to memory of 2632 2660 dwdsregt.exe 34 PID 2660 wrote to memory of 2632 2660 dwdsregt.exe 34 PID 2660 wrote to memory of 2632 2660 dwdsregt.exe 34 PID 2632 wrote to memory of 1920 2632 dwdsregt.exe 35 PID 2632 wrote to memory of 1920 2632 dwdsregt.exe 35 PID 2632 wrote to memory of 1920 2632 dwdsregt.exe 35 PID 2632 wrote to memory of 1920 2632 dwdsregt.exe 35 PID 1920 wrote to memory of 2188 1920 dwdsregt.exe 36 PID 1920 wrote to memory of 2188 1920 dwdsregt.exe 36 PID 1920 wrote to memory of 2188 1920 dwdsregt.exe 36 PID 1920 wrote to memory of 2188 1920 dwdsregt.exe 36 PID 2188 wrote to memory of 2388 2188 dwdsregt.exe 37 PID 2188 wrote to memory of 2388 2188 dwdsregt.exe 37 PID 2188 wrote to memory of 2388 2188 dwdsregt.exe 37 PID 2188 wrote to memory of 2388 2188 dwdsregt.exe 37 PID 2388 wrote to memory of 1712 2388 dwdsregt.exe 38 PID 2388 wrote to memory of 1712 2388 dwdsregt.exe 38 PID 2388 wrote to memory of 1712 2388 dwdsregt.exe 38 PID 2388 wrote to memory of 1712 2388 dwdsregt.exe 38 PID 1712 wrote to memory of 2952 1712 dwdsregt.exe 39 PID 1712 wrote to memory of 2952 1712 dwdsregt.exe 39 PID 1712 wrote to memory of 2952 1712 dwdsregt.exe 39 PID 1712 wrote to memory of 2952 1712 dwdsregt.exe 39 PID 2952 wrote to memory of 1620 2952 dwdsregt.exe 40 PID 2952 wrote to memory of 1620 2952 dwdsregt.exe 40 PID 2952 wrote to memory of 1620 2952 dwdsregt.exe 40 PID 2952 wrote to memory of 1620 2952 dwdsregt.exe 40 PID 1620 wrote to memory of 1320 1620 dwdsregt.exe 41 PID 1620 wrote to memory of 1320 1620 dwdsregt.exe 41 PID 1620 wrote to memory of 1320 1620 dwdsregt.exe 41 PID 1620 wrote to memory of 1320 1620 dwdsregt.exe 41 PID 1320 wrote to memory of 332 1320 dwdsregt.exe 42 PID 1320 wrote to memory of 332 1320 dwdsregt.exe 42 PID 1320 wrote to memory of 332 1320 dwdsregt.exe 42 PID 1320 wrote to memory of 332 1320 dwdsregt.exe 42 PID 332 wrote to memory of 3016 332 dwdsregt.exe 43 PID 332 wrote to memory of 3016 332 dwdsregt.exe 43 PID 332 wrote to memory of 3016 332 dwdsregt.exe 43 PID 332 wrote to memory of 3016 332 dwdsregt.exe 43 PID 3016 wrote to memory of 2192 3016 dwdsregt.exe 44 PID 3016 wrote to memory of 2192 3016 dwdsregt.exe 44 PID 3016 wrote to memory of 2192 3016 dwdsregt.exe 44 PID 3016 wrote to memory of 2192 3016 dwdsregt.exe 44 PID 2192 wrote to memory of 1500 2192 dwdsregt.exe 45 PID 2192 wrote to memory of 1500 2192 dwdsregt.exe 45 PID 2192 wrote to memory of 1500 2192 dwdsregt.exe 45 PID 2192 wrote to memory of 1500 2192 dwdsregt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd5b9329dce9d28b3ef8aba91494d54e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bd5b9329dce9d28b3ef8aba91494d54e_JaffaCakes118.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT0012⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT0013⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT0014⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT0015⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT0016⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT0017⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT0018⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT0019⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00110⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00111⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00112⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00113⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00114⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00115⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00116⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00117⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1500 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00118⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1852 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00119⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1740 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00120⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1572 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00121⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1272 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00122⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:800 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00123⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2524 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00124⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2584 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00125⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2408 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00126⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3068 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00127⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1032 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00128⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2088 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00129⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:876 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00130⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2436 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00131⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1000 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00132⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2236 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00133⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2868 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00134⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2764 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00135⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2796 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00136⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2816 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00137⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1192 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00138⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2652 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00139⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2124 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00140⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2620 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00141⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2376 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00142⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2320 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00143⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2960 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00144⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:840 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00145⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1760 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00146⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1840 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00147⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1372 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00148⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2968 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00149⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1092 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00150⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1564 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00151⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:916 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00152⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2092 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00153⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2192 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00154⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1500 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00155⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1852 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00156⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:808 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00157⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2056 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00158⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:940 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00159⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:776 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00160⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2720 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00161⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1632 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00162⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2596 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00163⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:3068 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00164⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1032 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00165⤵
- Drops startup file
- Executes dropped EXE
PID:2292 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00166⤵
- System Location Discovery: System Language Discovery
PID:1592 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00167⤵
- Drops startup file
- Drops file in System32 directory
PID:2436 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00168⤵PID:2732
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00169⤵
- Drops startup file
PID:2236 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00170⤵
- Drops startup file
- Drops file in System32 directory
PID:2892 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00171⤵
- System Location Discovery: System Language Discovery
PID:2800 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00172⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2908 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00173⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2692 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00174⤵
- Drops startup file
- Drops file in System32 directory
PID:2668 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00175⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2812 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00176⤵PID:2352
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00177⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2208 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00178⤵
- Drops startup file
- Drops file in System32 directory
PID:2384 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00179⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1828 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00180⤵PID:2980
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00181⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1780 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00182⤵
- System Location Discovery: System Language Discovery
PID:772 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00183⤵
- System Location Discovery: System Language Discovery
PID:2832 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00184⤵PID:1372
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00185⤵
- Drops startup file
- Drops file in System32 directory
PID:1020 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00186⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1508 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00187⤵PID:1564
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00188⤵
- Drops file in System32 directory
PID:2108 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00189⤵
- System Location Discovery: System Language Discovery
PID:916 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00190⤵
- Drops file in System32 directory
PID:2092 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00191⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2360 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00192⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1692 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00193⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:108 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00194⤵PID:2552
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00195⤵
- System Location Discovery: System Language Discovery
PID:1272 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00196⤵
- System Location Discovery: System Language Discovery
PID:1792 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00197⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:688 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00198⤵PID:1616
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT00199⤵
- System Location Discovery: System Language Discovery
PID:1804 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001100⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3052 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001101⤵
- Drops startup file
- Drops file in System32 directory
PID:1516 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001102⤵PID:2132
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001103⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1540 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001104⤵
- System Location Discovery: System Language Discovery
PID:1896 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001105⤵
- System Location Discovery: System Language Discovery
PID:2128 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001106⤵
- Drops startup file
- Drops file in System32 directory
PID:2784 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001107⤵PID:2852
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001108⤵PID:1344
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001109⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2232 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001110⤵PID:2672
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001111⤵
- Drops file in System32 directory
PID:2776 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001112⤵
- Drops startup file
- Drops file in System32 directory
PID:2716 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001113⤵PID:2760
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001114⤵
- Drops startup file
PID:2124 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001115⤵
- Drops file in System32 directory
PID:2060 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001116⤵
- Drops file in System32 directory
PID:1724 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001117⤵
- Drops startup file
- Drops file in System32 directory
PID:2928 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001118⤵PID:2960
-
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001119⤵
- System Location Discovery: System Language Discovery
PID:1612 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001120⤵
- System Location Discovery: System Language Discovery
PID:2052 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001121⤵
- Drops startup file
PID:2932 -
\??\c:\windows\SysWOW64\dwdsregt.exec:\windows\system32\dwdsregt.exe ELT001122⤵
- Drops startup file
PID:2976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-